meta user
network profile
| bio | website | |
|---|---|---|
| location | ||
| age | ||
| visits | member for | 1 year, 8 months |
| seen | 2 hours ago | |
| stats | profile views | 301 |
|
Aug 24 |
revised |
CSRF cookie vs session based tokens edited tags |
|
Aug 24 |
answered | Effectiveness of Security Images |
|
Aug 24 |
comment |
Effectiveness of Security Images Couldn't they use JS to pull the info directly from the client browser? |
|
Aug 24 |
comment |
Effectiveness of Security Images What security claims were made regarding the security image? That it prevents phishing? That it makes phishing slightly harder? |
|
Aug 24 |
comment |
Is it safer to use less heard of software than popular software? Should I live in a less crowded area, with less criminal acts per year? (Answer: maybe) |
|
Aug 23 |
comment |
Is it safer to use less heard of software than popular software? "And that the test user is not having password "test" or "password"" How the password of the test user relevant? |
|
Aug 23 |
comment |
What is the actual security of this login page? I'd like a good UI to indicate which webpage parts have been downloaded over HTTP. |
|
Aug 22 |
comment |
tor and widecap dns leak @Para "But suppose this were not my application and not an open source one. How could I solve the problem then?" How exactly does this close-source application perform DNS lookups? |
|
Aug 22 |
comment |
What is the actual security of this login page? See also Do most browsers handle mixed encrypted and unencrypted content correctly? |
|
Aug 22 |
revised |
What is the actual security of this login page? edited tags |
|
Aug 22 |
comment |
Confusion: Why isn't a passhrase encrypted SSH key two factor auth? +1 for "inherently unquantifiable" (and also for making up acronyms) |
|
Aug 22 |
revised |
What are the security precautions taken to ensure a virtualized domain can't compromise its host edited tags |
|
Aug 21 |
revised |
Can an intermediate CA be trusted like a self-signed root CA? edited tags |
|
Aug 21 |
comment |
How do RSA fingerprints protect from MITM attacks? If the fingerprint was a hash of the private key, you would need to private key to verify it! |
|
Aug 20 |
comment |
Can I trust the source IP of an HTTP request? There are difficult issues with per-IP resource meter even without IP spoofing. And it is even a lot more difficult with IPv6 (like, close to impossible). |
|
Aug 20 |
comment |
Signed request vs HTTP digest auth for API authentication? +1 "You should use HMAC for message authentication." Indeed, HMAC is the tool designed by cryptographer for exactly this purpose (message integrity). |
|
Aug 20 |
comment |
Are there technical disadvantages in using free ssl certificates? @Ramhound "Free certificate" as in "free beer" (one certificate, gratis), not free as in "free speech"! It's a certificate for a very low price: 0 $. |
|
Aug 20 |
revised |
Are there technical disadvantages in using free ssl certificates? edited tags |
|
Aug 19 |
comment |
Finding Win32.Sality sample for malware analysis purposes And do AV editors in general have some official feed for malware? |
|
Aug 19 |
comment |
Do you need to encrypt session data? Sorry I wasn't clear. Is /tmp written on disk storage? Is it a tmpfs filesystem? |
